CVE-2018-10392

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-10392
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10392.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-10392
Downstream
ALPINE (1)
AZL (1)
BELL (1)
DEBIAN (1)
MGASA (1)
openSUSE (1)
RHSA (1)
RLSA (1)
SUSE (3)
UBUNTU (1)
Related
ALSA (1)
openSUSE (1)
SUSE (3)
Published
2018-04-26T05:29:00Z
Modified
2026-07-27T03:56:45Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.0"
                },
                {
                    "last_affected":  "8.0"
                },
                {
                    "introduced":  "9.0"
                },
                {
                    "last_affected":  "9.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "debian:debian_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.0"
                },
                {
                    "last_affected":  "8.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "redhat:enterprise_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.1"
                },
                {
                    "last_affected":  "8.1"
                },
                {
                    "introduced":  "8.2"
                },
                {
                    "last_affected":  "8.2"
                },
                {
                    "introduced":  "8.4"
                },
                {
                    "last_affected":  "8.4"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "redhat:enterprise_linux_eus"
        },
        {
            "cpes":  [
                "cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.2"
                },
                {
                    "last_affected":  "8.2"
                },
                {
                    "introduced":  "8.4"
                },
                {
                    "last_affected":  "8.4"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "redhat:enterprise_linux_server_aus"
        },
        {
            "cpes":  [
                "cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.2"
                },
                {
                    "last_affected":  "8.2"
                },
                {
                    "introduced":  "8.4"
                },
                {
                    "last_affected":  "8.4"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "redhat:enterprise_linux_server_tus"
        }
    ]
}
References

Affected packages

Git / gitlab.xiph.org/xiph/vorbis

Affected ranges

Type
GIT
Repo
https://gitlab.xiph.org/xiph/vorbis
Events
Introduced
d22c3ab5f633460abc2532feee60ca0892134cbf
Last Affected
d22c3ab5f633460abc2532feee60ca0892134cbf
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:xiph.org:libvorbis:1.3.6:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "1.3.6"
        },
        {
            "last_affected":  "1.3.6"
        }
    ],
    "source":  "CPE_STRING"
}

Affected versions

1.*
1.3.6
v1.*
v1.3.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10392.json"